curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service
Published May 24, 2018
9.1
CRITICALCVSS 3.1
EPSS 5.92%
Description
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.
Affected products
No data.
Configuration 1
- 7.0
- 8.0
- 9.0
Configuration 2
- 12.04
- 14.04
- 16.04
- 17.10
- 18.04
Configuration 4
- 7.0
- 7.0
- 7.0
Configuration 5
- < 7.2
- 12.2.2
- 12.3.3
- 8.55
- 8.56
- 8.57
No data.
Red Hat Enterprise Linux 7
curl-0:7.29.0-51.el7
Fixed · RHSA-2018:3157
Red Hat Enterprise Linux 7
nss-pem-0:1.0.3-5.el7
Fixed · RHSA-2018:3157
Red Hat Enterprise Linux 7.4 Advanced Update Support
curl-0:7.29.0-42.el7_4.2
Fixed · RHSA-2020:0594
Red Hat Enterprise Linux 7.4 Telco Extended Update Support
curl-0:7.29.0-42.el7_4.2
Fixed · RHSA-2020:0594
Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
curl-0:7.29.0-42.el7_4.2
Fixed · RHSA-2020:0594
Red Hat Enterprise Linux 7.5 Extended Update Support
curl-0:7.29.0-46.el7_5.1
Fixed · RHSA-2020:0544
Red Hat Software Collections for Red Hat Enterprise Linux 6
httpd24-curl-0:7.61.1-1.el6
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 6
httpd24-httpd-0:2.4.34-7.el6
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 6
httpd24-nghttp2-0:1.7.1-7.el6
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7
httpd24-curl-0:7.61.1-1.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7
httpd24-httpd-0:2.4.34-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7
httpd24-nghttp2-0:1.7.1-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
httpd24-curl-0:7.61.1-1.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
httpd24-httpd-0:2.4.34-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
httpd24-nghttp2-0:1.7.1-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
httpd24-curl-0:7.61.1-1.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
httpd24-httpd-0:2.4.34-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
httpd24-nghttp2-0:1.7.1-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
httpd24-curl-0:7.61.1-1.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
httpd24-httpd-0:2.4.34-7.el7
Fixed · RHSA-2018:3558
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
httpd24-nghttp2-0:1.7.1-7.el7
Fixed · RHSA-2018:3558
.NET Core 1.0 on Red Hat Enterprise Linux
rh-dotnetcore10-curl
Out of support scope
.NET Core 1.1 on Red Hat Enterprise Linux
rh-dotnetcore11-curl
Out of support scope
.NET Core 2.0 on Red Hat Enterprise Linux
rh-dotnet20-curl
Out of support scope
.NET Core 2.1 on Red Hat Enterprise Linux
rh-dotnet21-curl
Will not fix
Red Hat Enterprise Linux 5
curl
Not affected
Red Hat Enterprise Linux 6
curl
Not affected
Red Hat Enterprise Linux 8
curl
Not affected
Red Hat JBoss Enterprise Web Server 3
curl
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | curl-0:7.29.0-51.el7 | Fixed | RHSA-2018:3157 |
| Red Hat Enterprise Linux 7 | nss-pem-0:1.0.3-5.el7 | Fixed | RHSA-2018:3157 |
| Red Hat Enterprise Linux 7.4 Advanced Update Support | curl-0:7.29.0-42.el7_4.2 | Fixed | RHSA-2020:0594 |
| Red Hat Enterprise Linux 7.4 Telco Extended Update Support | curl-0:7.29.0-42.el7_4.2 | Fixed | RHSA-2020:0594 |
| Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions | curl-0:7.29.0-42.el7_4.2 | Fixed | RHSA-2020:0594 |
| Red Hat Enterprise Linux 7.5 Extended Update Support | curl-0:7.29.0-46.el7_5.1 | Fixed | RHSA-2020:0544 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | httpd24-curl-0:7.61.1-1.el6 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | httpd24-httpd-0:2.4.34-7.el6 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | httpd24-nghttp2-0:1.7.1-7.el6 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | httpd24-curl-0:7.61.1-1.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | httpd24-httpd-0:2.4.34-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | httpd24-nghttp2-0:1.7.1-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | httpd24-curl-0:7.61.1-1.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | httpd24-httpd-0:2.4.34-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | httpd24-nghttp2-0:1.7.1-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | httpd24-curl-0:7.61.1-1.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | httpd24-httpd-0:2.4.34-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | httpd24-nghttp2-0:1.7.1-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | httpd24-curl-0:7.61.1-1.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | httpd24-httpd-0:2.4.34-7.el7 | Fixed | RHSA-2018:3558 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | httpd24-nghttp2-0:1.7.1-7.el7 | Fixed | RHSA-2018:3558 |
| .NET Core 1.0 on Red Hat Enterprise Linux | rh-dotnetcore10-curl | Out of support scope | n/a |
| .NET Core 1.1 on Red Hat Enterprise Linux | rh-dotnetcore11-curl | Out of support scope | n/a |
| .NET Core 2.0 on Red Hat Enterprise Linux | rh-dotnet20-curl | Out of support scope | n/a |
| .NET Core 2.1 on Red Hat Enterprise Linux | rh-dotnet21-curl | Will not fix | n/a |
| Red Hat Enterprise Linux 5 | curl | Not affected | n/a |
| Red Hat Enterprise Linux 6 | curl | Not affected | n/a |
| Red Hat Enterprise Linux 8 | curl | Not affected | n/a |
| Red Hat JBoss Enterprise Web Server 3 | curl | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (22)
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html x_refsource_CONFIRMPatch
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html x_refsource_CONFIRMPatch
- http://www.securityfocus.com/bid/104225 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040931 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHBA-2019:0327 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3157 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3558 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0544 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2020:0594 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2018-1000301 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1575536 Issue Tracking
- https://curl.haxx.se/docs/adv_2018-b138.html x_refsource_CONFIRMPatchVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1896 Advisory
- https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000301
- https://security.gentoo.org/glsa/201806-05 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://usn.ubuntu.com/3598-2/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/3648-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-1000301
- https://www.debian.org/security/2018/dsa-4202 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html x_refsource_CONFIRMPatchThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html x_refsource_MISC
Change history (0)
No recorded changes yet.